Chapter 2. Ceph Dashboard installation and access

Procedure

1. Enter the following URL in a web browser:

   Syntax

   https://HOST_NAME:PORT

   Replace:

   • HOST_NAME with the fully qualified domain name (FQDN) of the active manager host.

   • PORT with port 8443

     Example

     https://host01:8443

     You can also get the URL of the dashboard by running the following command in the Cephadm shell:

     Example

     [ceph: root@host01 /]# ceph mgr services

     This command will show you all endpoints that are currently configured. Look for the dashboard key to obtain the URL for accessing the dashboard.

2. On the login page, enter the username admin and the default password provided during bootstrapping.
3. You have to change the password the first time you log in to the Red Hat Ceph Storage dashboard.

4. After logging in, the dashboard default landing page is displayed, which provides details, a high-level overview of status, performance, inventory, and capacity metrics of the Red Hat Ceph Storage cluster.

   Figure 2.1. Ceph dashboard landing page

   
5. Click the menu icon ( ) on the dashboard landing page to collapse or display the options in the vertical menu.

Procedure

1. Copy the admin key from the bootstrapped host to other hosts:

   Syntax

   ssh-copy-id -f -i /etc/ceph/ceph.pub root@HOST_NAME

   Example

   [ceph: root@host01 /]# ssh-copy-id -f -i /etc/ceph/ceph.pub root@host02
   [ceph: root@host01 /]# ssh-copy-id -f -i /etc/ceph/ceph.pub root@host03

2. Log in to the dashboard with the default credentials provided during bootstrap.
3. Change the password and log in to the dashboard with the new password .

4. On the landing page, click Expand Cluster.

   Note

   Clicking Expand Cluster opens a wizard taking you through the expansion steps. To skip and add hosts and services separately, click Skip.

   Figure 2.2. Expand cluster

   

5. Add hosts. This needs to be done for each host in the storage cluster.

   1. In the Add Hosts step, click Add.

   2. Provide the hostname. This is same as the hostname that was provided while copying the key from the bootstrapped host.

      Note

      Add multiple hosts by using a comma-separated list of host names, a range expression, or a comma separated range expression.

   3. Optional: Provide the respective IP address of the host.
   4. Optional: Select the labels for the hosts on which the services are going to be created. Click the pencil icon to select or add new labels.

   5. Click Add Host.

      The new host is displayed in the Add Hosts pane.

   6. Click Next.

6. Create OSDs:

   1. In the Create OSDs step, for Primary devices, Click Add.
   2. In the Primary Devices window, filter for the device and select the device.
   3. Click Add.
   4. Optional: In the Create OSDs window, if you have any shared devices such as WAL or DB devices, then add the devices.
   5. Optional: In the Features section, select Encryption to encrypt the features.
   6. Click Next.

7. Create services:

   1. In the Create Services step, click Create.

   2. In the Create Service form:

      1. Select a service type.
      2. Provide the service ID. The ID is a unique name for the service. This ID is used in the service name, which is service_type.service_id.

1. Select if the placement is by hosts or label.
2. Select the hosts.

3. In the Count field, provide the number of daemons or services that need to be deployed.

   1. Click Create Service.

      The new service is displayed in the Create Services pane.

      1. In the Create Service window, Click Next.

      2. Review the cluster expansion details.

         Review the Cluster Resources, Hosts by Services, Host Details. To edit any parameters, click Back and follow the previous steps.

         Figure 2.3. Review cluster

         

      3. Click Expand Cluster.

         The Cluster expansion displayed notification is displayed and the cluster status changes to HEALTH_OK on the dashboard.

Verification

1. Log in to the cephadm shell:

   Example

   [root@host01 ~]# cephadm shell

2. Run the ceph -s command.

   Example

   [ceph: root@host01 /]# ceph -s

   The health of the cluster is HEALTH_OK.

Procedure

1. View if cluster upgrades are available and upgrade as needed from Administration > Upgrade on the dashboard.

   Note

   If the dashboard displays the Not retrieving upgrades message, check if the registries were added to the container configuration files with the appropriate log in credentials to Podman or docker.

   Click Pause or Stop during the upgrade process, if needed. The upgrade progress is shown in the progress bar along with information messages during the upgrade.

   Note

   When stopping the upgrade, the upgrade is first paused and then prompts you to stop the upgrade.

2. Optional. View cluster logs during the upgrade process from the Cluster logs section of the Upgrade page.
3. Verify that the upgrade is completed successfully by confirming that the cluster status displays OK state.

Procedure

1. Log in to the dashboard:

   Syntax

   https://HOST_NAME:8443

2. Go to User→Change password on the menu bar.
3. Enter the old password, for verification.
4. In the New password field enter a new password. Passwords must contain a minimum of 8 characters and cannot be the same as the last one.
5. In the Confirm password field, enter the new password again to confirm.

6. Click Change Password.

   You will be logged out and redirected to the login screen. A notification appears confirming the password is changed.

Procedure

1. Log into the Cephadm shell:

   Example

   [root@host01 ~]# cephadm shell

2. Create the dashboard_password.yml file:

   Example

   [ceph: root@host01 /]# touch dashboard_password.yml

3. Edit the file and add the new dashboard password:

   Example

   [ceph: root@host01 /]# vi dashboard_password.yml

4. Reset the dashboard password:

   Syntax

   ceph dashboard ac-user-set-password DASHBOARD_USERNAME -i PASSWORD_FILE

   Example

   [ceph: root@host01 /]# ceph dashboard ac-user-set-password admin -i dashboard_password.yml
   {"username": "admin", "password": "$2b$12$i5RmvN1PolR61Fay0mPgt.GDpcga1QpYsaHUbJfoqaHd1rfFFx7XS", "roles": ["administrator"], "name": null, "email": null, "lastUpdate": , "enabled": true, "pwdExpirationDate": null, "pwdUpdateRequired": false}

Procedure

1. As a root user, create a grafana.yml file and provide the following details:

   Syntax

   service_type: grafana
   spec:
     initial_admin_password: PASSWORD

   Example

   service_type: grafana
   spec:
     initial_admin_password: mypassword

2. Mount the grafana.yml file under a directory in the container:

   Example

   [root@host01 ~]# cephadm shell --mount grafana.yml:/var/lib/ceph/grafana.yml

   Note

   Every time you exit the shell, you have to mount the file in the container before deploying the daemon.

3. Optional: Check if the dashboard Ceph Manager module is enabled:

   Example

   [ceph: root@host01 /]# ceph mgr module ls

4. Optional: Enable the dashboard Ceph Manager module:

   Example

   [ceph: root@host01 /]# ceph mgr module enable dashboard

5. Apply the specification using the orch command:

   Syntax

   ceph orch apply -i FILE_NAME.yml

   Example

   [ceph: root@host01 /]# ceph orch apply -i /var/lib/ceph/grafana.yml

6. Redeploy grafana service:

   Example

   [ceph: root@host01 /]# ceph orch redeploy grafana

   This creates an admin user called admin with the given password and the user can log in to the Grafana URL with these credentials.

Procedure

1. Log into the Cephadm shell:

   Example

   [root@host01 ~]# cephadm shell

2. Check the Ceph Manager services:

   Example

   [ceph: root@host01 /]# ceph mgr services
   
   {
       "prometheus": "http://10.8.0.101:9283/"
   }

   You can see that the Dashboard URL is not configured.

3. Enable the dashboard module:

   Example

   [ceph: root@host01 /]# ceph mgr module enable dashboard

4. Create the self-signed certificate for the dashboard access:

   Example

   [ceph: root@host01 /]# ceph dashboard create-self-signed-cert

   Note

   You can disable the certificate verification to avoid certification errors.

5. Check the Ceph Manager services:

   Example

   [ceph: root@host01 /]# ceph mgr services
   
   {
       "dashboard": "https://10.8.0.101:8443/",
       "prometheus": "http://10.8.0.101:9283/"
   }

6. Create the admin user and password to access the Red Hat Ceph Storage dashboard:

   Syntax

   echo -n "PASSWORD" > PASSWORD_FILE
   ceph dashboard ac-user-create admin -i PASSWORD_FILE administrator

   Example

   [ceph: root@host01 /]# echo -n "p@ssw0rd" > password.txt
   [ceph: root@host01 /]# ceph dashboard ac-user-create admin -i password.txt administrator

7. Enable the monitoring stack. See the Enabling monitoring stack section in the Red Hat Ceph Storage Dashboard Guide for details.

Procedure

1. Download the Red Hat Single Sign-On 7.4.0 Server on the system where Red Hat Ceph Storage is installed.

2. Unzip the folder:

   [root@host01 ~]# unzip rhsso-7.4.0.zip

3. Navigate to the standalone/configuration directory and open the standalone.xml for editing:

   [root@host01 ~]# cd standalone/configuration
   [root@host01 configuration]# vi standalone.xml

4. From the bin directory of the newly created rhsso-7.4.0 folder, run the add-user-keycloak script to add the initial administrator user:

   [root@host01 bin]# ./add-user-keycloak.sh -u admin

5. Replace all instances of localhost and two instances of 127.0.0.1 with the IP address of the machine where Red Hat SSO is installed.

6. Start the server. From the bin directory of rh-sso-7.4 folder, run the standalone boot script:

   [root@host01 bin]# ./standalone.sh

7. Create the admin account in https: IP_ADDRESS :8080/auth with a username and password:

   Note

   You have to create an admin account only the first time that you log into the console.

8. Log into the admin console with the credentials created.

Procedure

1. To create a realm, click the Master drop-down menu. In this realm, you can provide access to users and applications.

2. In the Add Realm window, enter a case-sensitive realm name and set the parameter Enabled to ON and click Create:

   

3. In the Realm Settings tab, set the following parameters and click Save:

   1. Enabled - ON
   2. User-Managed Access - ON

   3. Make a note of the link address of SAML 2.0 Identity Provider Metadata to paste in Client Settings.

      

4. In the Clients tab, click Create:

   

5. In the Add Client window, set the following parameters and click Save:

   1. Client ID - BASE_URL:8443/auth/saml2/metadata

      Example

      https://example.ceph.redhat.com:8443/auth/saml2/metadata

   2. Client Protocol - saml

6. In the Client window, under Settings tab, set the following parameters:

   Table 2.2. Client Settings tab

   Name of the parameter	Syntax	Example
   Client ID	BASE_URL:8443/auth/saml2/metadata	https://example.ceph.redhat.com:8443/auth/saml2/metadata
   Enabled	ON	ON
   Client Protocol	saml	saml
   Include AuthnStatement	ON	ON
   Sign Documents	ON	ON
   Signature Algorithm	RSA_SHA1	RSA_SHA1
   SAML Signature Key Name	KEY_ID	KEY_ID
   Valid Redirect URLs	BASE_URL:8443/*	https://example.ceph.redhat.com:8443/*
   Base URL	BASE_URL:8443	https://example.ceph.redhat.com:8443/
   Master SAML Processing URL	https://localhost:8080/auth/realms/REALM_NAME/protocol/saml/descriptor	https://localhost:8080/auth/realms/Ceph_LDAP/protocol/saml/descriptor

   Note

   Paste the link of SAML 2.0 Identity Provider Metadata from Realm Settings tab.

   Under Fine Grain SAML Endpoint Configuration, set the following parameters and click Save:

   Table 2.3. Fine Grain SAML configuration

   Name of the parameter	Syntax	Example
   Assertion Consumer Service POST Binding URL	BASE_URL:8443/#/dashboard	https://example.ceph.redhat.com:8443/#/dashboard
   Assertion Consumer Service Redirect Binding URL	BASE_URL:8443/#/dashboard	https://example.ceph.redhat.com:8443/#/dashboard
   Logout Service Redirect Binding URL	BASE_URL:8443/	https://example.ceph.redhat.com:8443/

7. In the Clients window, Mappers tab, set the following parameters and click Save:

   Table 2.4. Client Mappers tab

   Name of the parameter	Value
   Protocol	saml
   Name	username
   Mapper Property	User Property
   Property	username
   SAML Attribute name	username

8. In the Clients Scope tab, select role_list:

   1. In Mappers tab, select role list, set the Single Role Attribute to ON.

9. Select User_Federation tab:

   1. In User Federation window, select ldap from the drop-down menu:

   2. In User_Federation window, Settings tab, set the following parameters and click Save:

      Table 2.5. User Federation Settings tab

      Name of the parameter	Value
      Console Display Name	rh-ldap
      Import Users	ON
      Edit_Mode	READ_ONLY
      Username LDAP attribute	username
      RDN LDAP attribute	username
      UUID LDAP attribute	nsuniqueid
      User Object Classes	inetOrgPerson, organizationalPerson, rhatPerson
      Connection URL	Example: ldap://ldap.corp.redhat.com Click Test Connection. You will get a notification that the LDAP connection is successful.
      Users DN	ou=users, dc=example, dc=com
      Bind Type	simple

      Click Test authentication. You will get a notification that the LDAP authentication is successful.

   3. In Mappers tab, select first name row and edit the following parameter and Click Save:

      • LDAP Attribute - givenName

   4. In User_Federation tab, Settings tab, Click Synchronize all users:

      

      You will get a notification that the sync of users is finished successfully.

10. In the Users tab, search for the user added to the dashboard and click the Search icon:

    

11. To view the user , click the specific row. You should see the federation link as the name provided for the User Federation.

    
    Important

    Do not add users manually as the users will not be synchronized by LDAP. If added manually, delete the user by clicking Delete.

    Note

    If Red Hat SSO is currently being used within your work environment, be sure to first enable SSO. For more information, see the Enabling Single Sign-On for the Ceph Dashboard section in the Red Hat Ceph Storage Dashboard Guide.

Procedure

1. To configure SSO on Ceph Dashboard, run the following command:

   Syntax

   cephadm shell CEPH_MGR_HOST ceph dashboard sso setup saml2 CEPH_DASHBOARD_BASE_URL IDP_METADATA IDP_USERNAME_ATTRIBUTE IDP_ENTITY_ID SP_X_509_CERT SP_PRIVATE_KEY

   Example

   [root@host01 ~]# cephadm shell host01 ceph dashboard sso setup saml2 https://dashboard_hostname.ceph.redhat.com:8443 idp-metadata.xml username https://10.70.59.125:8080/auth/realms/realm_name /home/certificate.txt /home/private-key.txt

   Replace

   • CEPH_MGR_HOST with Ceph mgr host. For example, host01
   • CEPH_DASHBOARD_BASE_URL with the base URL where Ceph Dashboard is accessible.
   • IDP_METADATA with the URL to remote or local path or content of the IdP metadata XML. The supported URL types are http, https, and file.
   • Optional: IDP_USERNAME_ATTRIBUTE with the attribute used to get the username from the authentication response. Defaults to uid.
   • Optional: IDP_ENTITY_ID with the IdP entity ID when more than one entity ID exists on the IdP metadata.
   • Optional: SP_X_509_CERT with the file path of the certificate used by Ceph Dashboard for signing and encryption.
   • Optional: SP_PRIVATE_KEY with the file path of the private key used by Ceph Dashboard for signing and encryption.

2. Verify the current SAML 2.0 configuration:

   Syntax

   cephadm shell CEPH_MGR_HOST ceph dashboard sso show saml2

   Example

   [root@host01 ~]#  cephadm shell host01 ceph dashboard sso show saml2

3. To enable SSO, run the following command:

   Syntax

   cephadm shell CEPH_MGR_HOST ceph dashboard sso enable saml2
   SSO is "enabled" with "SAML2" protocol.

   Example

   [root@host01 ~]#  cephadm shell host01 ceph dashboard sso enable saml2

4. Open your dashboard URL.

   Example

   https://dashboard_hostname.ceph.redhat.com:8443

5. On the SSO page, enter the login credentials. SSO redirects to the dashboard web interface.

Procedure

1. To view status of SSO, run the following command:

   Syntax

   cephadm shell CEPH_MGR_HOST ceph dashboard sso status

   Example

   [root@host01 ~]#  cephadm shell host01 ceph dashboard sso status
   SSO is "enabled" with "SAML2" protocol.

2. To disable SSO, run the following command:

   Syntax

   cephadm shell CEPH_MGR_HOST ceph dashboard sso disable
   SSO is "disabled".

   Example

   [root@host01 ~]#  cephadm shell host01 ceph dashboard sso disable